diff --git a/src/components/App.test.tsx b/src/components/App.test.tsx
index 40f4649f..13d48e1c 100644
--- a/src/components/App.test.tsx
+++ b/src/components/App.test.tsx
@@ -15,6 +15,7 @@ vi.mock('../utils', () => ({
 
 const capturedCallbacks = vi.hoisted(() => ({
   onCommand: null as ((command: string) => void) | null,
+  onModeChange: null as ((mode: string) => void) | null,
   onSelect: null as ((model: string) => void) | null,
   onCancel: null as (() => void) | null,
   onToggleMode: null as (() => void) | null,
@@ -29,12 +30,15 @@ vi.mock('./Header', () => ({
 vi.mock('./Chat', () => ({
   Chat: ({
     onCommand,
+    onModeChange,
   }: {
     model: string;
     onCommand: (command: string) => void;
-    autoExecute: boolean;
+    mode: string;
+    onModeChange: (mode: string) => void;
   }) => {
     capturedCallbacks.onCommand = onCommand;
+    capturedCallbacks.onModeChange = onModeChange;
     return <Text>{'>'}</Text>;
   },
 }));
@@ -56,14 +60,15 @@ vi.mock('./ModelPicker', () => ({
 
 vi.mock('./Footer', () => ({
   Footer: ({
-    autoExecute,
+    mode,
     onToggleMode,
   }: {
-    autoExecute: boolean;
+    mode: string;
     onToggleMode: () => void;
   }) => {
     capturedCallbacks.onToggleMode = onToggleMode;
-    return <Text>Mode: {autoExecute ? 'Auto' : 'Safe'}</Text>;
+    const modeLabel = mode.charAt(0).toUpperCase() + mode.slice(1);
+    return <Text>Mode: {modeLabel}</Text>;
   },
 }));
 
@@ -72,6 +77,7 @@ import { App } from './App';
 describe('App', () => {
   beforeEach(() => {
     capturedCallbacks.onCommand = null;
+    capturedCallbacks.onModeChange = null;
     capturedCallbacks.onSelect = null;
     capturedCallbacks.onCancel = null;
     capturedCallbacks.onToggleMode = null;
@@ -127,25 +133,44 @@ describe('App', () => {
     expect(lastFrame()).not.toContain('ModelPicker');
   });
 
-  it('toggles autoExecute via Footer onToggleMode callback', async () => {
+  it('toggles mode via Footer onToggleMode callback (3-state cycle)', async () => {
     const { lastFrame, rerender } = render(<App />);
 
-    // Initial state
+    // Initial state: Safe
     expect(lastFrame()).toContain('Mode: Safe');
 
-    // Call the callback passed to Footer
+    // Call the callback passed to Footer - cycles to Auto
     capturedCallbacks.onToggleMode?.();
     rerender(<App />);
     await tick();
-
-    // Should show Auto mode
     expect(lastFrame()).toContain('Mode: Auto');
 
-    // Call again to toggle back
+    // Call again - cycles to Plan
+    capturedCallbacks.onToggleMode?.();
+    rerender(<App />);
+    await tick();
+    expect(lastFrame()).toContain('Mode: Plan');
+
+    // Call again - cycles back to Safe
     capturedCallbacks.onToggleMode?.();
     rerender(<App />);
     await tick();
+    expect(lastFrame()).toContain('Mode: Safe');
+  });
+
+  it('updates footer mode when Chat changes execution mode', async () => {
+    const { lastFrame, rerender } = render(<App />);
 
     expect(lastFrame()).toContain('Mode: Safe');
+
+    capturedCallbacks.onModeChange?.('auto');
+    rerender(<App />);
+    await tick();
+    expect(lastFrame()).toContain('Mode: Auto');
+
+    capturedCallbacks.onModeChange?.('safe');
+    rerender(<App />);
+    await tick();
+    expect(lastFrame()).toContain('Mode: Safe');
   });
 });
diff --git a/src/components/App.tsx b/src/components/App.tsx
index 6f198b4a..74d9d877 100644
--- a/src/components/App.tsx
+++ b/src/components/App.tsx
@@ -1,6 +1,7 @@
 import { Box } from 'ink';
 import { useCallback, useState } from 'react';
 
+import { MODE } from '../constants';
 import { config } from '../utils';
 import { Chat } from './Chat';
 import { Footer } from './Footer';
@@ -10,7 +11,7 @@ import { ModelPicker } from './ModelPicker';
 export function App() {
   const [model, setModel] = useState(() => config.loadConfig().model);
   const [picking, setPicking] = useState(false);
-  const [autoExecute, setAutoExecute] = useState(false);
+  const [mode, setMode] = useState<MODE.Name>(MODE.NAME.SAFE);
 
   const handleCommand = useCallback((command: string) => {
     if (command === '/model') {
@@ -42,14 +43,26 @@ export function App() {
         <Chat
           model={model}
           onCommand={handleCommand}
-          autoExecute={autoExecute}
+          mode={mode}
+          onModeChange={setMode}
         />
       )}
 
       <Footer
-        autoExecute={autoExecute}
+        mode={mode}
         onToggleMode={() => {
-          setAutoExecute((isAutoExecute) => !isAutoExecute);
+          setMode((mode) => {
+            // Cycle: safe -> auto -> plan -> safe
+            switch (mode) {
+              case MODE.NAME.SAFE:
+                return MODE.NAME.AUTO;
+              case MODE.NAME.AUTO:
+                return MODE.NAME.PLAN;
+              case MODE.NAME.PLAN:
+              default:
+                return MODE.NAME.SAFE;
+            }
+          });
         }}
       />
     </Box>
diff --git a/src/components/Chat.test.tsx b/src/components/Chat.test.tsx
deleted file mode 100644
index afba95cd..00000000
--- a/src/components/Chat.test.tsx
+++ /dev/null
@@ -1,537 +0,0 @@
-import { Text } from 'ink';
-import { render } from 'ink-testing-library';
-
-import { tick } from '../utils/test';
-
-const mockState = vi.hoisted(() => ({
-  handlers: [] as ((value: string) => void)[],
-  testInput: '',
-  shouldReset: false,
-  clear() {
-    this.handlers.length = 0;
-    this.testInput = '';
-    this.shouldReset = true;
-  },
-}));
-
-vi.mock('../utils', async () => {
-  const actual = await vi.importActual<typeof import('../utils')>('../utils');
-  return {
-    ...actual,
-    ollama: {
-      streamChat: vi.fn().mockImplementation(function* () {
-        yield { type: 'content', content: 'Mocked' };
-        yield { type: 'content', content: ' response' };
-      }),
-    },
-    tools: {
-      TOOLS: [],
-      TOOLS_REQUIRING_APPROVAL: new Set(),
-      executeTool: vi.fn(),
-    },
-  };
-});
-
-vi.mock('./ChatInput', () => ({
-  ChatInput: (props: {
-    onSubmit?: (value: string) => void;
-    isDisabled?: boolean;
-  }) => {
-    if (props.onSubmit) {
-      mockState.handlers.push(props.onSubmit);
-    }
-
-    if (props.isDisabled) {
-      return null;
-    }
-
-    const displayValue = mockState.shouldReset
-      ? ((mockState.shouldReset = false), '')
-      : mockState.testInput;
-
-    return (
-      <Text>
-        {'>'}
-        {displayValue}
-      </Text>
-    );
-  },
-}));
-
-import { Chat } from './Chat';
-
-async function typeText(
-  rerender: (tree: React.ReactElement) => void,
-  text: string,
-  tree: React.ReactElement,
-) {
-  mockState.testInput = text;
-  rerender(tree);
-  await tick();
-}
-
-function submitInput(value: string) {
-  for (const handler of mockState.handlers) {
-    handler(value);
-  }
-  mockState.clear();
-}
-
-async function waitForStream() {
-  // Allow time for async generator to yield values
-  await tick(10);
-}
-
-describe('Chat', () => {
-  beforeEach(() => {
-    mockState.clear();
-  });
-
-  it('renders input prompt without system message', async () => {
-    const { lastFrame } = render(
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />,
-    );
-    await tick();
-    const frame = lastFrame() ?? '';
-    expect(frame).not.toContain('coding assistant');
-    expect(frame).toContain('>');
-  });
-
-  it('shows message after submit', async () => {
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-    await tick();
-    await typeText(rerender, 'hello', chat);
-    submitInput('hello');
-    rerender(chat);
-    await waitForStream();
-    const frame = lastFrame() ?? '';
-    expect(frame).toContain('hello');
-  });
-
-  it('clears input after submit', async () => {
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-    await tick();
-    await typeText(rerender, 'hello', chat);
-    submitInput('hello');
-    rerender(chat);
-    await waitForStream();
-    // Verify the user message appears in the chat
-    const frame = lastFrame() ?? '';
-    expect(frame).toContain('hello');
-  });
-
-  it('does not add blank messages', async () => {
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-    await tick();
-    const beforeFrame = lastFrame() ?? '';
-    const systemLineCount = beforeFrame.split('\n').length;
-    await typeText(rerender, '   ', chat);
-    submitInput('   ');
-    rerender(chat);
-    await tick();
-    const afterFrame = lastFrame() ?? '';
-    const afterLineCount = afterFrame.split('\n').length;
-    // After submitting blank input, line count should not increase
-    // (no new user message added)
-    expect(afterLineCount).toBe(systemLineCount);
-    expect(afterFrame).not.toContain('coding assistant');
-  });
-
-  it('shows multiple messages in order', async () => {
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-    await tick();
-    await typeText(rerender, 'first', chat);
-    submitInput('first');
-    rerender(chat);
-    await waitForStream();
-    await typeText(rerender, 'second', chat);
-    submitInput('second');
-    rerender(chat);
-    await waitForStream();
-    const frame = lastFrame() ?? '';
-    const firstIdx = frame.indexOf('first');
-    const secondIdx = frame.indexOf('second');
-    expect(firstIdx).toBeGreaterThanOrEqual(0);
-    expect(secondIdx).toBeGreaterThan(firstIdx);
-  });
-
-  it('calls onCommand when a slash command is submitted', async () => {
-    const onCommand = vi.fn();
-    const chat = (
-      <Chat model="gemma4" onCommand={onCommand} autoExecute={false} />
-    );
-    const { rerender } = render(chat);
-    submitInput('/model');
-    rerender(chat);
-    await tick();
-    expect(onCommand).toHaveBeenCalledWith('/model');
-  });
-
-  it('passes model prop to streamChat', async () => {
-    const { ollama } = await import('../utils');
-    const { streamChat } = ollama;
-    vi.mocked(streamChat).mockClear();
-
-    const chat = (
-      <Chat model="llama3" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { rerender } = render(chat);
-    submitInput('hello');
-    rerender(chat);
-    await waitForStream();
-
-    expect(vi.mocked(streamChat)).toHaveBeenLastCalledWith(
-      expect.any(Array),
-      'llama3',
-      expect.any(Array),
-    );
-  });
-});
-
-describe('Chat with tool calls', () => {
-  beforeEach(() => {
-    mockState.clear();
-  });
-
-  it('shows tool approval when tool requires approval', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'write_file',
-              arguments: { path: '/test.txt', content: 'hello' },
-            },
-          },
-        ],
-      };
-    });
-
-    // Set write_file as requiring approval
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(true);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-
-    await typeText(rerender, 'write a file', chat);
-    submitInput('write a file');
-    rerender(chat);
-    await waitForStream();
-    rerender(chat);
-
-    expect(lastFrame()).toContain('Tool requires approval');
-  });
-
-  it('auto-executes tool that does not require approval', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'read_file',
-              arguments: { path: '/test.txt' },
-            },
-          },
-        ],
-      };
-    });
-
-    // Mock executeTool to return content (auto-executed since read_file doesn't require approval)
-    const mockExecute = vi.fn().mockResolvedValue({
-      content: 'file contents',
-    });
-    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
-
-    // read_file does not require approval
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(false);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { rerender } = render(chat);
-
-    await typeText(rerender, 'read file', chat);
-    submitInput('read file');
-    rerender(chat);
-    await waitForStream();
-
-    expect(mockExecute).toHaveBeenCalledWith('read_file', {
-      path: '/test.txt',
-    });
-  });
-
-  it('handles tool result error', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'read_file',
-              arguments: { path: '/missing.txt' },
-            },
-          },
-        ],
-      };
-    });
-
-    // Use local mock implementation for executeTool
-    const mockExecute = vi.fn().mockResolvedValue({
-      content: '',
-      error: 'File not found',
-    });
-    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
-
-    // read_file does not require approval
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(false);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-
-    await typeText(rerender, 'read file', chat);
-    submitInput('read file');
-    rerender(chat);
-    await waitForStream();
-
-    // The tool result message should contain the error
-    expect(lastFrame()).toContain('File not found');
-  });
-
-  it('handles tool approval rejection', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'write_file',
-              arguments: { path: '/test.txt', content: 'hello' },
-            },
-          },
-        ],
-      };
-    });
-
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(true);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender, stdin } = render(chat);
-
-    await typeText(rerender, 'write a file', chat);
-    submitInput('write a file');
-    rerender(chat);
-    await waitForStream();
-    rerender(chat);
-
-    // Verify approval prompt is shown
-    expect(lastFrame()).toContain('Tool requires approval');
-
-    // Reject the tool (move to No with right arrow, then Enter)
-    stdin.write('\x1B[C'); // Right arrow
-    await tick();
-    stdin.write('\r'); // Enter
-    await tick();
-    rerender(chat);
-
-    // Should show rejection message
-    expect(lastFrame()).toContain('declined');
-  });
-
-  it('handles tool approval acceptance', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'write_file',
-              arguments: { path: '/test.txt', content: 'hello' },
-            },
-          },
-        ],
-      };
-    });
-
-    // Second call after tool execution
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield { type: 'content', content: 'Done' };
-    });
-
-    const mockExecute = vi.fn().mockResolvedValue({
-      content: 'File written successfully',
-    });
-    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
-
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(true);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender, stdin } = render(chat);
-
-    await typeText(rerender, 'write a file', chat);
-    submitInput('write a file');
-    rerender(chat);
-    await waitForStream();
-    rerender(chat);
-
-    // Verify approval prompt is shown
-    expect(lastFrame()).toContain('Tool requires approval');
-
-    // Approve the tool by pressing Enter (yes is default)
-    stdin.write('\r'); // Enter
-    await tick();
-    rerender(chat);
-
-    // Should have called executeTool
-    expect(mockExecute).toHaveBeenCalledWith('write_file', {
-      path: '/test.txt',
-      content: 'hello',
-    });
-  });
-
-  it('handles tool result with error in approval flow', async () => {
-    const { ollama, tools } = await import('../utils');
-    const { streamChat } = ollama;
-
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield {
-        type: 'tool_calls',
-        tool_calls: [
-          {
-            function: {
-              name: 'write_file',
-              arguments: { path: '/test.txt', content: 'hello' },
-            },
-          },
-        ],
-      };
-    });
-
-    // Second call after tool execution (with error)
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield { type: 'content', content: 'Error handled' };
-    });
-
-    const mockExecute = vi.fn().mockResolvedValue({
-      content: '',
-      error: 'Permission denied',
-    });
-    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
-
-    vi.spyOn(tools.TOOLS_REQUIRING_APPROVAL, 'has').mockReturnValue(true);
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { rerender, stdin } = render(chat);
-
-    await typeText(rerender, 'write a file', chat);
-    submitInput('write a file');
-    rerender(chat);
-    await waitForStream();
-    rerender(chat);
-
-    // Approve the tool by pressing Enter
-    stdin.write('\r');
-    await tick();
-    rerender(chat);
-
-    // Should have called executeTool
-    expect(mockExecute).toHaveBeenCalled();
-  });
-});
-
-describe('Chat with error', () => {
-  beforeEach(() => {
-    mockState.clear();
-  });
-
-  it('shows error message when stream fails with Error', async () => {
-    const { ollama } = await import('../utils');
-    const { streamChat } = ollama;
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield { type: 'content', content: '' };
-      throw new Error('Connection failed');
-    });
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-
-    await typeText(rerender, 'hello', chat);
-    submitInput('hello');
-    rerender(chat);
-    await waitForStream();
-
-    expect(lastFrame()).toContain('Error: Connection failed');
-  });
-
-  it('shows error message when stream fails with non-Error', async () => {
-    const { ollama } = await import('../utils');
-    const { streamChat } = ollama;
-    vi.mocked(streamChat).mockImplementationOnce(async function* () {
-      await Promise.resolve();
-      yield { type: 'content', content: '' };
-      // eslint-disable-next-line @typescript-eslint/only-throw-error
-      throw { toString: () => 'Custom error' };
-    });
-
-    const chat = (
-      <Chat model="gemma4" onCommand={vi.fn()} autoExecute={false} />
-    );
-    const { lastFrame, rerender } = render(chat);
-
-    await typeText(rerender, 'hello', chat);
-    submitInput('hello');
-    rerender(chat);
-    await waitForStream();
-
-    expect(lastFrame()).toContain('Error: Custom error');
-  });
-});
diff --git a/src/components/Chat.tsx b/src/components/Chat.tsx
deleted file mode 100644
index 0725e611..00000000
--- a/src/components/Chat.tsx
+++ /dev/null
@@ -1,202 +0,0 @@
-import { Box } from 'ink';
-import { useCallback, useState } from 'react';
-
-import { ROLE, TOOL } from '../constants';
-import { agents, ollama, tools } from '../utils';
-import { ChatInput } from './ChatInput';
-import { Messages } from './Messages';
-import { ToolApproval } from './ToolApproval';
-
-interface Props {
-  model: string;
-  onCommand: (command: string) => void;
-  autoExecute: boolean;
-}
-
-export function Chat({ model, onCommand, autoExecute }: Props) {
-  const [messages, setMessages] = useState<ollama.Message[]>([
-    agents.createSystemMessage(),
-  ]);
-  const [isLoading, setIsLoading] = useState(false);
-  const [pendingToolCall, setPendingToolCall] =
-    useState<ollama.ToolCall | null>(null);
-
-  const processStream = useCallback(
-    async (currentMessages: ollama.Message[]) => {
-      const assistantMessage: ollama.Message = {
-        role: ROLE.ASSISTANT,
-        content: '',
-      };
-
-      setMessages((previousMessages) => [
-        ...previousMessages,
-        assistantMessage,
-      ]);
-
-      try {
-        for await (const chunk of ollama.streamChat(
-          currentMessages,
-          model,
-          tools.TOOLS,
-        )) {
-          if (chunk.type === 'content') {
-            assistantMessage.content += chunk.content;
-            setMessages((previousMessages) => {
-              const newMessages = [...previousMessages];
-              newMessages[newMessages.length - 1] = { ...assistantMessage };
-              return newMessages;
-            });
-          } else if (
-            // v8 ignore start
-            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-            chunk.type === 'tool_calls'
-            // v8 ignore stop
-          ) {
-            // Handle tool calls
-            for (const toolCall of chunk.tool_calls) {
-              const requiresApproval = tools.TOOLS_REQUIRING_APPROVAL.has(
-                toolCall.function.name as
-                  | typeof TOOL.NAME.WRITE_FILE
-                  | typeof TOOL.NAME.RUN_SHELL,
-              );
-
-              if (!autoExecute && requiresApproval) {
-                // Pause for approval
-                setPendingToolCall(toolCall);
-                setIsLoading(false);
-                return;
-              }
-
-              // Execute tool
-              const result = await tools.executeTool(
-                toolCall.function.name,
-                toolCall.function.arguments,
-              );
-
-              // Add tool result as system message
-              const toolResultMessage: ollama.Message = {
-                role: ROLE.SYSTEM,
-                content: `Tool ${toolCall.function.name} result:\n${result.content}${result.error ? `\nError: ${result.error}` : ''}`,
-              };
-
-              const newMessages = [
-                ...currentMessages,
-                assistantMessage,
-                toolResultMessage,
-              ];
-              setMessages((previousMessages) => [
-                ...previousMessages,
-                toolResultMessage,
-              ]);
-
-              // Continue conversation with tool result
-              await processStream(newMessages);
-              return;
-            }
-          }
-        }
-      } catch (error) {
-        assistantMessage.content = `Error: ${error instanceof Error ? error.message : String(error)}`;
-        setMessages((previousMessages) => {
-          const newMessages = [...previousMessages];
-          newMessages[newMessages.length - 1] = { ...assistantMessage };
-          return newMessages;
-        });
-      } finally {
-        setIsLoading(false);
-      }
-    },
-    [model, autoExecute],
-  );
-
-  const handleToolApproval = useCallback(
-    async (approved: boolean) => {
-      // v8 ignore next
-      if (!pendingToolCall) {
-        return;
-      }
-
-      const toolCall = pendingToolCall;
-      setPendingToolCall(null);
-      setIsLoading(true);
-
-      if (approved) {
-        const result = await tools.executeTool(
-          toolCall.function.name,
-          toolCall.function.arguments,
-        );
-
-        const toolResultMessage: ollama.Message = {
-          role: ROLE.SYSTEM,
-          content: `Tool ${toolCall.function.name} result:\n${result.content}${result.error ? `\nError: ${result.error}` : ''}`,
-        };
-
-        const newMessages = [...messages, toolResultMessage];
-        setMessages((previousMessages) => [
-          ...previousMessages,
-          toolResultMessage,
-        ]);
-        await processStream(newMessages);
-      } else {
-        // Tool was rejected
-        const rejectionMessage: ollama.Message = {
-          role: ROLE.SYSTEM,
-          content: `User declined to execute tool ${toolCall.function.name}`,
-        };
-        const newMessages = [...messages, rejectionMessage];
-        setMessages((previousMessages) => [
-          ...previousMessages,
-          rejectionMessage,
-        ]);
-        await processStream(newMessages);
-      }
-    },
-    [pendingToolCall, messages, processStream],
-  );
-
-  const handleSubmit = useCallback(
-    async (value: string) => {
-      const userContent = value.trim();
-      if (!userContent) {
-        return;
-      }
-
-      if (userContent.startsWith('/')) {
-        onCommand(userContent);
-        return;
-      }
-
-      setIsLoading(true);
-
-      const userMessage: ollama.Message = {
-        role: ROLE.USER,
-        content: userContent,
-      };
-      setMessages((previousMessages) => [...previousMessages, userMessage]);
-
-      const updatedMessages = [...messages, userMessage];
-      await processStream(updatedMessages);
-    },
-    [messages, onCommand, processStream],
-  );
-
-  return (
-    <Box flexDirection="column">
-      {/* exclude system message from display */}
-      <Messages messages={messages.slice(1)} isLoading={isLoading} />
-
-      {pendingToolCall && (
-        <ToolApproval
-          toolCall={pendingToolCall}
-          onApprove={() => void handleToolApproval(true)}
-          onReject={() => void handleToolApproval(false)}
-        />
-      )}
-
-      {!pendingToolCall && (
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        <ChatInput isDisabled={isLoading} onSubmit={handleSubmit} />
-      )}
-    </Box>
-  );
-}
diff --git a/src/components/Chat/Chat.test.tsx b/src/components/Chat/Chat.test.tsx
new file mode 100644
index 00000000..ecd4770c
--- /dev/null
+++ b/src/components/Chat/Chat.test.tsx
@@ -0,0 +1,1126 @@
+import { Text } from 'ink';
+import { render } from 'ink-testing-library';
+
+import { MODE } from '../../constants';
+import { ollama, tools } from '../../utils';
+import { tick } from '../../utils/test';
+
+const mockState = vi.hoisted(() => ({
+  handlers: [] as ((value: string) => void)[],
+  testInput: '',
+  shouldReset: false,
+  clear() {
+    this.handlers.length = 0;
+    this.testInput = '';
+    this.shouldReset = true;
+  },
+}));
+
+const planApprovalState = vi.hoisted(() => ({
+  onChange: undefined as ((value: MODE.Name) => void) | undefined,
+  clear() {
+    this.onChange = undefined;
+  },
+}));
+
+vi.mock('@inkjs/ui', async () => {
+  const actual = await vi.importActual<typeof import('@inkjs/ui')>('@inkjs/ui');
+  const { Text } = await import('ink');
+  return {
+    ...actual,
+    Select: ({
+      options,
+      onChange,
+    }: {
+      options: { label: string; value: MODE.Name }[];
+      onChange?: (value: MODE.Name) => void;
+    }) => {
+      planApprovalState.onChange = onChange;
+      return (
+        <>
+          {options.map(({ value, label }) => (
+            <Text key={value}>{label}</Text>
+          ))}
+        </>
+      );
+    },
+  };
+});
+
+vi.mock('../../utils', async () => {
+  const actual =
+    await vi.importActual<typeof import('../../utils')>('../../utils');
+  return {
+    ...actual,
+    ollama: {
+      streamChat: vi.fn().mockImplementation(function* () {
+        yield { type: 'content', content: 'Mocked' };
+        yield { type: 'content', content: ' response' };
+      }),
+    },
+    tools: {
+      TOOLS: [],
+      READ_ONLY_TOOLS: new Set(),
+      DANGEROUS_TOOLS: new Set(),
+      executeTool: vi.fn(),
+    },
+  };
+});
+
+vi.mock('./Input', () => ({
+  Input: (props: {
+    onSubmit?: (value: string) => void;
+    isDisabled?: boolean;
+  }) => {
+    if (props.onSubmit) {
+      mockState.handlers.push(props.onSubmit);
+    }
+
+    if (props.isDisabled) {
+      return null;
+    }
+
+    const displayValue = mockState.shouldReset
+      ? ((mockState.shouldReset = false), '')
+      : mockState.testInput;
+
+    return (
+      <Text>
+        {'>'}
+        {displayValue}
+      </Text>
+    );
+  },
+}));
+
+import { Chat } from './Chat';
+
+async function typeText(
+  rerender: (tree: React.ReactElement) => void,
+  text: string,
+  tree: React.ReactElement,
+) {
+  mockState.testInput = text;
+  rerender(tree);
+  await tick();
+}
+
+function submitInput(value: string) {
+  for (const handler of mockState.handlers) {
+    handler(value);
+  }
+  mockState.clear();
+}
+
+function choosePlanMode(mode: MODE.Name) {
+  planApprovalState.onChange?.(mode);
+}
+
+async function waitForStream() {
+  // Allow time for async generator to yield values
+  await tick(10);
+}
+
+function resetChatMocks() {
+  vi.restoreAllMocks();
+  vi.clearAllMocks();
+  mockState.clear();
+  planApprovalState.clear();
+  tools.TOOLS.splice(0, tools.TOOLS.length);
+  vi.mocked(ollama.streamChat).mockImplementation(async function* () {
+    await Promise.resolve();
+    yield { type: 'content', content: 'Mocked' };
+    yield { type: 'content', content: ' response' };
+  });
+  vi.mocked(tools.executeTool).mockReset();
+}
+
+describe('Chat', () => {
+  beforeEach(() => {
+    resetChatMocks();
+  });
+
+  const onModeChange = vi.fn();
+
+  it('renders input prompt without system message', async () => {
+    const { lastFrame } = render(
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />,
+    );
+    await tick();
+    const frame = lastFrame() ?? '';
+    expect(frame).not.toContain('coding assistant');
+    expect(frame).toContain('>');
+  });
+
+  it('shows message after submit', async () => {
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+    await tick();
+    await typeText(rerender, 'hello', chat);
+    submitInput('hello');
+    rerender(chat);
+    await waitForStream();
+    const frame = lastFrame() ?? '';
+    expect(frame).toContain('hello');
+  });
+
+  it('clears input after submit', async () => {
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+    await tick();
+    await typeText(rerender, 'hello', chat);
+    submitInput('hello');
+    rerender(chat);
+    await waitForStream();
+    // Verify the user message appears in the chat
+    const frame = lastFrame() ?? '';
+    expect(frame).toContain('hello');
+  });
+
+  it('does not add blank messages', async () => {
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+    await tick();
+    const beforeFrame = lastFrame() ?? '';
+    const systemLineCount = beforeFrame.split('\n').length;
+    await typeText(rerender, '   ', chat);
+    submitInput('   ');
+    rerender(chat);
+    await tick();
+    const afterFrame = lastFrame() ?? '';
+    const afterLineCount = afterFrame.split('\n').length;
+    // After submitting blank input, line count should not increase
+    // (no new user message added)
+    expect(afterLineCount).toBe(systemLineCount);
+    expect(afterFrame).not.toContain('coding assistant');
+  });
+
+  it('shows multiple messages in order', async () => {
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+    await tick();
+    await typeText(rerender, 'first', chat);
+    submitInput('first');
+    rerender(chat);
+    await waitForStream();
+    await typeText(rerender, 'second', chat);
+    submitInput('second');
+    rerender(chat);
+    await waitForStream();
+    const frame = lastFrame() ?? '';
+    const firstIdx = frame.indexOf('first');
+    const secondIdx = frame.indexOf('second');
+    expect(firstIdx).toBeGreaterThanOrEqual(0);
+    expect(secondIdx).toBeGreaterThan(firstIdx);
+  });
+
+  it('calls onCommand when a slash command is submitted', async () => {
+    const onCommand = vi.fn();
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={onCommand}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { rerender } = render(chat);
+    submitInput('/model');
+    rerender(chat);
+    await tick();
+    expect(onCommand).toHaveBeenCalledWith('/model');
+  });
+
+  it('passes model prop to streamChat', async () => {
+    const { streamChat } = ollama;
+    vi.mocked(streamChat).mockClear();
+
+    const chat = (
+      <Chat
+        model="llama3"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { rerender } = render(chat);
+    submitInput('hello');
+    rerender(chat);
+    await waitForStream();
+
+    expect(vi.mocked(streamChat)).toHaveBeenLastCalledWith(
+      expect.any(Array),
+      'llama3',
+      expect.any(Array),
+    );
+  });
+
+  it('shows blocked policy details when a tool is denied by policy', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'read_file',
+              arguments: { path: '/blocked.txt' },
+            },
+          },
+        ],
+      };
+    });
+
+    vi.mocked(tools.executeTool).mockResolvedValue({
+      content: '',
+      error: 'Tool not allowed: read_file',
+    });
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(false);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'read blocked file', chat);
+    submitInput('read blocked file');
+    rerender(chat);
+    await waitForStream();
+
+    expect(lastFrame()).toContain(
+      'Tool read_file was blocked by execution policy',
+    );
+    expect(lastFrame()).toContain('The requested action was NOT performed');
+  });
+});
+
+describe('Chat with tool calls', () => {
+  beforeEach(() => {
+    resetChatMocks();
+  });
+
+  it('shows tool approval when tool requires approval', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    // Set write_file as requiring approval
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(true);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    expect(lastFrame()).toContain('Tool requires approval');
+  });
+
+  it('auto-executes tool that does not require approval', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'read_file',
+              arguments: { path: '/test.txt' },
+            },
+          },
+        ],
+      };
+    });
+
+    // Mock executeTool to return content (auto-executed since read_file doesn't require approval)
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: 'file contents',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    // read_file does not require approval
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(false);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { rerender } = render(chat);
+
+    await typeText(rerender, 'read file', chat);
+    submitInput('read file');
+    rerender(chat);
+    await waitForStream();
+
+    expect(mockExecute).toHaveBeenCalledWith(
+      'read_file',
+      {
+        path: '/test.txt',
+      },
+      { allowedTools: undefined },
+    );
+  });
+
+  it('handles tool result error', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'read_file',
+              arguments: { path: '/missing.txt' },
+            },
+          },
+        ],
+      };
+    });
+
+    // Use local mock implementation for executeTool
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: '',
+      error: 'File not found',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    // read_file does not require approval
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(false);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'read file', chat);
+    submitInput('read file');
+    rerender(chat);
+    await waitForStream();
+
+    // The tool result message should contain the error
+    expect(lastFrame()).toContain('File not found');
+  });
+
+  it('blocks destructive tools in plan mode', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Blocked. No changes were made.' };
+    });
+
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: '',
+      error: 'Tool not allowed: write_file',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+
+    expect(mockExecute).not.toHaveBeenCalled();
+    expect(lastFrame()).toContain('The requested action was NOT performed');
+    expect(lastFrame()).toContain(
+      'Plan mode policy: write_file cannot be executed during planning',
+    );
+    expect(lastFrame()).toContain('Blocked. No changes were made.');
+    expect(
+      vi
+        .mocked(streamChat)
+        .mock.calls.some(([callMessages]) =>
+          callMessages.some((message) =>
+            message.content.includes(
+              'Then display the execution plan as an unchecked Markdown checklist only',
+            ),
+          ),
+        ),
+    ).toBe(true);
+  });
+
+  it('reminds plan mode to display a checklist after a blocked write tool call', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'content',
+        content: '- [ ] write_file("src/test.ts", "content") - Update the file',
+      };
+    });
+
+    const mockExecute = vi.fn();
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+
+    expect(mockExecute).not.toHaveBeenCalled();
+    expect(lastFrame()).toContain(
+      'Plan mode policy: write_file cannot be executed during planning',
+    );
+    expect(lastFrame()).toContain(
+      'Then display the execution plan as an unchecked Markdown checklist only',
+    );
+    expect(lastFrame()).toContain(
+      '- [ ] write_file("src/test.ts", "content") - Update the file',
+    );
+  });
+
+  it('executes read-only tools during plan research before generating a plan', async () => {
+    const { streamChat } = ollama;
+    tools.TOOLS.push({
+      type: 'function',
+      function: {
+        name: 'read_file',
+        description: 'Read a file',
+        parameters: {
+          type: 'object',
+          properties: {},
+          required: [],
+        },
+      },
+    });
+
+    vi.spyOn(tools.READ_ONLY_TOOLS, 'has').mockImplementation(
+      (name) => name === 'read_file',
+    );
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'read_file',
+              arguments: { path: '/notes.md' },
+            },
+          },
+        ],
+      };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'tool_calls', tool_calls: [] };
+      yield {
+        type: 'content',
+        content: '- [ ] write_file("src/test.ts", "content") - Update the file',
+      };
+    });
+
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: 'file contents',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'research the file', chat);
+    submitInput('research the file');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    expect(mockExecute).toHaveBeenCalledWith(
+      'read_file',
+      { path: '/notes.md' },
+      { allowedTools: tools.READ_ONLY_TOOLS },
+    );
+    expect(lastFrame()).toContain('Tool read_file result:');
+    expect(lastFrame()).toContain('Plan Generated');
+  });
+
+  it('shows plan execution approval and stays in plan mode when canceled', async () => {
+    const { streamChat } = ollama;
+    const onModeChange = vi.fn();
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'content',
+        content: '- [ ] write_file("src/test.ts", "content") - Update the file',
+      };
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'make a plan', chat);
+    submitInput('make a plan');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    expect(lastFrame()).toContain('Plan Generated');
+
+    choosePlanMode(MODE.NAME.PLAN);
+    await tick();
+    rerender(chat);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.PLAN);
+    expect(lastFrame()).toContain(
+      'Continuing in Plan mode. No tools were executed.',
+    );
+
+    choosePlanMode(MODE.NAME.AUTO);
+    await tick();
+  });
+
+  it('executes an approved plan immediately in auto mode', async () => {
+    const { streamChat } = ollama;
+    const onModeChange = vi.fn();
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'content',
+        content: '- [ ] write_file("src/test.ts", "content") - Update the file',
+      };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Executed automatically.' };
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={onModeChange}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'execute automatically', chat);
+    submitInput('execute automatically');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    choosePlanMode(MODE.NAME.AUTO);
+    await waitForStream();
+    rerender(chat);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.AUTO);
+    expect(
+      vi
+        .mocked(streamChat)
+        .mock.calls.some(([messages]) =>
+          messages.some((message) =>
+            message.content.includes(
+              'Execute the plan above. Use tools as needed without asking for further confirmation.',
+            ),
+          ),
+        ),
+    ).toBe(true);
+    expect(lastFrame()).toContain('Executed automatically.');
+  });
+
+  it('executes an approved plan in safe mode with approval instructions', async () => {
+    const { streamChat } = ollama;
+    const onModeChange = vi.fn();
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'content',
+        content: '- [ ] write_file("src/test.ts", "content") - Update the file',
+      };
+    });
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Waiting safely.' };
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={onModeChange}
+      />
+    );
+    const { rerender } = render(chat);
+
+    await typeText(rerender, 'execute safely', chat);
+    submitInput('execute safely');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    choosePlanMode(MODE.NAME.SAFE);
+    await waitForStream();
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.SAFE);
+    expect(
+      vi
+        .mocked(streamChat)
+        .mock.calls.some(([messages]) =>
+          messages.some((message) =>
+            message.content.includes(
+              'Execute the plan above one step at a time. Wait for user approval before each tool call that modifies files or runs commands.',
+            ),
+          ),
+        ),
+    ).toBe(true);
+  });
+
+  it('handles tool approval rejection', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(true);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender, stdin } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    // Verify approval prompt is shown
+    expect(lastFrame()).toContain('Tool requires approval');
+
+    // Reject the tool (move to No with right arrow, then Enter)
+    stdin.write('\x1B[C'); // Right arrow
+    await tick();
+    stdin.write('\r'); // Enter
+    await tick();
+    rerender(chat);
+
+    // Should show rejection message
+    expect(lastFrame()).toContain('declined');
+  });
+
+  it('handles tool approval acceptance', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    // Second call after tool execution
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Done' };
+    });
+
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: 'File written successfully',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(true);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender, stdin } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    // Verify approval prompt is shown
+    expect(lastFrame()).toContain('Tool requires approval');
+
+    // Approve the tool by pressing Enter (yes is default)
+    stdin.write('\r'); // Enter
+    await tick();
+    rerender(chat);
+
+    // Should have called executeTool
+    expect(mockExecute).toHaveBeenCalledWith('write_file', {
+      path: '/test.txt',
+      content: 'hello',
+    });
+  });
+
+  it('handles tool result with error in approval flow', async () => {
+    const { streamChat } = ollama;
+
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield {
+        type: 'tool_calls',
+        tool_calls: [
+          {
+            function: {
+              name: 'write_file',
+              arguments: { path: '/test.txt', content: 'hello' },
+            },
+          },
+        ],
+      };
+    });
+
+    // Second call after tool execution (with error)
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Error handled' };
+    });
+
+    const mockExecute = vi.fn().mockResolvedValue({
+      content: '',
+      error: 'Permission denied',
+    });
+    vi.mocked(tools.executeTool).mockImplementation(mockExecute);
+
+    vi.spyOn(tools.DANGEROUS_TOOLS, 'has').mockReturnValue(true);
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { rerender, stdin } = render(chat);
+
+    await typeText(rerender, 'write a file', chat);
+    submitInput('write a file');
+    rerender(chat);
+    await waitForStream();
+    rerender(chat);
+
+    // Approve the tool by pressing Enter
+    stdin.write('\r');
+    await tick();
+    rerender(chat);
+
+    // Should have called executeTool
+    expect(mockExecute).toHaveBeenCalled();
+  });
+});
+
+describe('Chat with error', () => {
+  beforeEach(() => {
+    resetChatMocks();
+  });
+
+  it('shows error message when stream fails with Error', async () => {
+    const { streamChat } = ollama;
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: '' };
+      throw new Error('Connection failed');
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'hello', chat);
+    submitInput('hello');
+    rerender(chat);
+    await waitForStream();
+
+    expect(lastFrame()).toContain('Error: Connection failed');
+  });
+
+  it('shows error message when stream fails with non-Error', async () => {
+    const { streamChat } = ollama;
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: '' };
+      // eslint-disable-next-line @typescript-eslint/only-throw-error
+      throw { toString: () => 'Custom error' };
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.SAFE}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'hello', chat);
+    submitInput('hello');
+    rerender(chat);
+    await waitForStream();
+
+    expect(lastFrame()).toContain('Error: Custom error');
+  });
+
+  it('shows error message when plan-mode research fails with Error', async () => {
+    const { streamChat } = ollama;
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: '' };
+      throw new Error('Research failed');
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'research', chat);
+    submitInput('research');
+    rerender(chat);
+    await waitForStream();
+
+    expect(lastFrame()).toContain('Error: Research failed');
+  });
+
+  it('shows error message when plan generation fails with non-Error', async () => {
+    const { streamChat } = ollama;
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: 'Research complete.' };
+    });
+    vi.mocked(streamChat).mockImplementationOnce(async function* () {
+      await Promise.resolve();
+      yield { type: 'content', content: '' };
+      // eslint-disable-next-line @typescript-eslint/only-throw-error
+      throw { toString: () => 'Plan generation failed' };
+    });
+
+    const chat = (
+      <Chat
+        model="gemma4"
+        onCommand={vi.fn()}
+        mode={MODE.NAME.PLAN}
+        onModeChange={vi.fn()}
+      />
+    );
+    const { lastFrame, rerender } = render(chat);
+
+    await typeText(rerender, 'plan', chat);
+    submitInput('plan');
+    rerender(chat);
+    await waitForStream();
+
+    expect(lastFrame()).toContain('Error: Plan generation failed');
+  });
+});
diff --git a/src/components/Chat/Chat.tsx b/src/components/Chat/Chat.tsx
new file mode 100644
index 00000000..22874dd5
--- /dev/null
+++ b/src/components/Chat/Chat.tsx
@@ -0,0 +1,457 @@
+import { Box } from 'ink';
+import { useCallback, useState } from 'react';
+
+import { MODE, PROMPT, ROLE } from '../../constants';
+import { agents, ollama, tools } from '../../utils';
+import { Messages } from '../Messages';
+import { PlanApproval } from '../PlanApproval';
+import { ToolApproval } from '../ToolApproval';
+import {
+  ACTION_NOT_PERFORMED,
+  PLAN_CHECKLIST_REMINDER,
+  PLAN_EXECUTION_REMINDER,
+} from './constants';
+import { Input } from './Input';
+import { hasExecutablePlan } from './plan';
+
+interface Props {
+  model: string;
+  onCommand: (command: string) => void;
+  mode: MODE.Name;
+  onModeChange: (mode: MODE.Name) => void;
+}
+
+export function Chat({ model, onCommand, mode, onModeChange }: Props) {
+  const [messages, setMessages] = useState<ollama.Message[]>([
+    agents.createSystemMessage(),
+  ]);
+  const [isLoading, setIsLoading] = useState(false);
+  const [pendingToolCall, setPendingToolCall] =
+    useState<ollama.ToolCall | null>(null);
+  const [pendingPlan, setPendingPlan] = useState<{
+    planContent: string;
+    messages: ollama.Message[];
+  } | null>(null);
+
+  const buildToolResultMessage = useCallback(
+    (toolName: string, result: tools.ToolExecutionResult): ollama.Message => {
+      if (result.error?.startsWith('Tool not allowed:')) {
+        return {
+          role: ROLE.SYSTEM,
+          content: [
+            `Tool ${toolName} was blocked by execution policy`,
+            ACTION_NOT_PERFORMED,
+            `Blocked because ${result.error}`,
+            'Do not claim success. Either continue with allowed read-only tools or explain that approval/execution mode must change',
+          ].join('\n'),
+        };
+      }
+
+      return {
+        role: ROLE.SYSTEM,
+        content: `Tool ${toolName} result:\n${result.content}${result.error ? `\nError: ${result.error}` : ''}`,
+      };
+    },
+    [],
+  );
+
+  const buildPlanModeCorrectionMessage = useCallback(
+    (toolName: string): ollama.Message => ({
+      role: ROLE.SYSTEM,
+      content: [
+        `Plan mode policy: ${toolName} cannot be executed during planning`,
+        ACTION_NOT_PERFORMED,
+        'Continue by using only read-only tools for research if needed',
+        PLAN_CHECKLIST_REMINDER,
+        PLAN_EXECUTION_REMINDER,
+      ].join('\n'),
+    }),
+    [],
+  );
+
+  const processStream = useCallback(
+    async (
+      currentMessages: ollama.Message[],
+      executionMode: MODE.Name = mode,
+    ) => {
+      const assistantMessage: ollama.Message = {
+        role: ROLE.ASSISTANT,
+        content: '',
+      };
+
+      setMessages((previousMessages) => [
+        ...previousMessages,
+        assistantMessage,
+      ]);
+
+      try {
+        for await (const chunk of ollama.streamChat(
+          currentMessages,
+          model,
+          tools.TOOLS,
+        )) {
+          if (chunk.type === 'content') {
+            assistantMessage.content += chunk.content;
+            setMessages((previousMessages) => {
+              const newMessages = [...previousMessages];
+              newMessages[newMessages.length - 1] = { ...assistantMessage };
+              return newMessages;
+            });
+          } else if (
+            // v8 ignore start
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            chunk.type === 'tool_calls'
+            // v8 ignore stop
+          ) {
+            // Handle tool calls
+            for (const toolCall of chunk.tool_calls) {
+              const requiresApproval = tools.DANGEROUS_TOOLS.has(
+                toolCall.function.name,
+              );
+              // v8 ignore start
+              const allowedTools =
+                executionMode === MODE.NAME.PLAN
+                  ? tools.READ_ONLY_TOOLS
+                  : undefined;
+              // v8 ignore stop
+
+              if (executionMode === MODE.NAME.SAFE && requiresApproval) {
+                // Pause for approval
+                setPendingToolCall(toolCall);
+                setIsLoading(false);
+                return;
+              }
+
+              // Execute tool
+              const result = await tools.executeTool(
+                toolCall.function.name,
+                toolCall.function.arguments,
+                { allowedTools },
+              );
+
+              const toolResultMessage = buildToolResultMessage(
+                toolCall.function.name,
+                result,
+              );
+
+              const newMessages = [
+                ...currentMessages,
+                assistantMessage,
+                toolResultMessage,
+              ];
+              setMessages((previousMessages) => [
+                ...previousMessages,
+                toolResultMessage,
+              ]);
+
+              // Continue conversation with tool result
+              await processStream(newMessages, executionMode);
+              return;
+            }
+          }
+        }
+      } catch (error) {
+        assistantMessage.content = `Error: ${error instanceof Error ? error.message : String(error)}`;
+        setMessages((previousMessages) => {
+          const newMessages = [...previousMessages];
+          newMessages[newMessages.length - 1] = { ...assistantMessage };
+          return newMessages;
+        });
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [buildToolResultMessage, model, mode],
+  );
+
+  // Process stream with only read-only tools (for plan mode research phase)
+  const processStreamReadOnly = useCallback(
+    async (currentMessages: ollama.Message[]) => {
+      const assistantMessage: ollama.Message = {
+        role: ROLE.ASSISTANT,
+        content: '',
+      };
+      setMessages((previousMessages) => [
+        ...previousMessages,
+        assistantMessage,
+      ]);
+
+      try {
+        // Filter to only read-only tools during research phase
+        const readOnlyTools = tools.TOOLS.filter((tool) =>
+          tools.READ_ONLY_TOOLS.has(tool.function.name),
+        );
+
+        for await (const chunk of ollama.streamChat(
+          currentMessages,
+          model,
+          readOnlyTools,
+        )) {
+          if (chunk.type === 'content') {
+            assistantMessage.content += chunk.content;
+            setMessages((previousMessages) => {
+              const newMessages = [...previousMessages];
+              newMessages[newMessages.length - 1] = { ...assistantMessage };
+              return newMessages;
+            });
+          } else if (
+            // v8 ignore start
+            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+            chunk.type === 'tool_calls'
+            // v8 ignore stop
+          ) {
+            // Execute read-only tools immediately during research
+            for (const toolCall of chunk.tool_calls) {
+              if (!tools.READ_ONLY_TOOLS.has(toolCall.function.name)) {
+                const correctionMessage = buildPlanModeCorrectionMessage(
+                  toolCall.function.name,
+                );
+
+                const newMessages = [
+                  ...currentMessages,
+                  assistantMessage,
+                  correctionMessage,
+                ];
+                setMessages((previousMessages) => [
+                  ...previousMessages,
+                  correctionMessage,
+                ]);
+
+                await processStreamReadOnly(newMessages);
+                return;
+              }
+
+              const result = await tools.executeTool(
+                toolCall.function.name,
+                toolCall.function.arguments,
+                { allowedTools: tools.READ_ONLY_TOOLS },
+              );
+
+              const toolResultMessage = buildToolResultMessage(
+                toolCall.function.name,
+                result,
+              );
+
+              const newMessages = [
+                ...currentMessages,
+                assistantMessage,
+                toolResultMessage,
+              ];
+              setMessages((previousMessages) => [
+                ...previousMessages,
+                toolResultMessage,
+              ]);
+
+              // Continue with read-only stream
+              await processStreamReadOnly(newMessages);
+              return;
+            }
+          }
+        }
+
+        // Research phase complete - now generate plan with write tools
+        // Add instruction to create a plan
+        const planInstruction: ollama.Message = {
+          role: ROLE.SYSTEM,
+          content: PROMPT.PLAN_GENERATION_INSTRUCTION,
+        };
+
+        const planMessages = [
+          ...currentMessages,
+          assistantMessage,
+          planInstruction,
+        ];
+
+        // Generate the plan
+        const planAssistantMessage: ollama.Message = {
+          role: ROLE.ASSISTANT,
+          content: '',
+        };
+        setMessages((previousMessages) => [
+          ...previousMessages,
+          planAssistantMessage,
+        ]);
+
+        // Stream plan generation (no tools, just text output)
+        for await (const chunk of ollama.streamChat(
+          planMessages,
+          model,
+          [], // No tools during plan generation output
+        )) {
+          if (chunk.type === 'content') {
+            planAssistantMessage.content += chunk.content;
+            setMessages((previousMessages) => {
+              const newMessages = [...previousMessages];
+              newMessages[newMessages.length - 1] = { ...planAssistantMessage };
+              return newMessages;
+            });
+          }
+        }
+
+        // Store pending plan for approval
+        if (hasExecutablePlan(planAssistantMessage.content)) {
+          setPendingPlan({
+            planContent: planAssistantMessage.content,
+            messages: [...planMessages, planAssistantMessage],
+          });
+        }
+        setIsLoading(false);
+      } catch (error) {
+        assistantMessage.content = `Error: ${error instanceof Error ? error.message : String(error)}`;
+        setMessages((previousMessages) => {
+          const newMessages = [...previousMessages];
+          newMessages[newMessages.length - 1] = { ...assistantMessage };
+          return newMessages;
+        });
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [buildPlanModeCorrectionMessage, buildToolResultMessage, model],
+  );
+
+  const handlePlanApproval = useCallback(
+    async (choice: MODE.Name) => {
+      // v8 ignore next
+      if (!pendingPlan) {
+        return;
+      }
+
+      const { messages: planMessages } = pendingPlan;
+      setPendingPlan(null);
+
+      if (choice === MODE.NAME.PLAN) {
+        onModeChange(MODE.NAME.PLAN);
+        const cancelMessage: ollama.Message = {
+          role: ROLE.SYSTEM,
+          content: 'Continuing in Plan mode. No tools were executed.',
+        };
+        setMessages((previousMessages) => [...previousMessages, cancelMessage]);
+        return;
+      }
+
+      const selectedMode =
+        choice === MODE.NAME.AUTO ? MODE.NAME.AUTO : MODE.NAME.SAFE;
+      onModeChange(selectedMode);
+      setIsLoading(true);
+
+      // Add instruction to execute the plan
+      const executeInstruction: ollama.Message = {
+        role: ROLE.SYSTEM,
+        content:
+          choice === MODE.NAME.AUTO
+            ? 'Execute the plan above. Use tools as needed without asking for further confirmation.'
+            : 'Execute the plan above one step at a time. Wait for user approval before each tool call that modifies files or runs commands.',
+      };
+
+      const executeMessages = [...planMessages, executeInstruction];
+
+      await processStream(executeMessages, selectedMode);
+    },
+    [onModeChange, pendingPlan, processStream],
+  );
+
+  const handleToolApproval = useCallback(
+    async (approved: boolean) => {
+      // v8 ignore next
+      if (!pendingToolCall) {
+        return;
+      }
+
+      const toolCall = pendingToolCall;
+      setPendingToolCall(null);
+      setIsLoading(true);
+
+      if (approved) {
+        const result = await tools.executeTool(
+          toolCall.function.name,
+          toolCall.function.arguments,
+        );
+
+        const toolResultMessage: ollama.Message = {
+          role: ROLE.SYSTEM,
+          content: `Tool ${toolCall.function.name} result:\n${result.content}${result.error ? `\nError: ${result.error}` : ''}`,
+        };
+
+        const newMessages = [...messages, toolResultMessage];
+        setMessages((previousMessages) => [
+          ...previousMessages,
+          toolResultMessage,
+        ]);
+        await processStream(newMessages);
+      } else {
+        // Tool was rejected
+        const rejectionMessage: ollama.Message = {
+          role: ROLE.SYSTEM,
+          content: `User declined to execute tool ${toolCall.function.name}`,
+        };
+        const newMessages = [...messages, rejectionMessage];
+        setMessages((previousMessages) => [
+          ...previousMessages,
+          rejectionMessage,
+        ]);
+        await processStream(newMessages);
+      }
+    },
+    [pendingToolCall, messages, processStream],
+  );
+
+  const handleSubmit = useCallback(
+    async (value: string) => {
+      const userContent = value.trim();
+      if (!userContent) {
+        return;
+      }
+
+      if (userContent.startsWith('/')) {
+        onCommand(userContent);
+        return;
+      }
+
+      setIsLoading(true);
+
+      const userMessage: ollama.Message = {
+        role: ROLE.USER,
+        content: userContent,
+      };
+      setMessages((previousMessages) => [...previousMessages, userMessage]);
+
+      const updatedMessages = [...messages, userMessage];
+
+      // Use plan mode stream if in plan mode, otherwise normal stream
+      if (mode === MODE.NAME.PLAN) {
+        await processStreamReadOnly(updatedMessages);
+      } else {
+        await processStream(updatedMessages);
+      }
+    },
+    [messages, onCommand, processStream, processStreamReadOnly, mode],
+  );
+
+  return (
+    <Box flexDirection="column">
+      {/* exclude system message from display */}
+      <Messages messages={messages.slice(1)} isLoading={isLoading} />
+
+      {pendingPlan && (
+        <PlanApproval
+          planContent={pendingPlan.planContent}
+          onModeChange={(selectedMode) => void handlePlanApproval(selectedMode)}
+        />
+      )}
+
+      {!pendingPlan && pendingToolCall && (
+        <ToolApproval
+          toolCall={pendingToolCall}
+          onApprove={() => void handleToolApproval(true)}
+          onReject={() => void handleToolApproval(false)}
+        />
+      )}
+
+      {!pendingPlan && !pendingToolCall && (
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        <Input isDisabled={isLoading} onSubmit={handleSubmit} />
+      )}
+    </Box>
+  );
+}
diff --git a/src/components/ChatInput.test.tsx b/src/components/Chat/Input.test.tsx
similarity index 72%
rename from src/components/ChatInput.test.tsx
rename to src/components/Chat/Input.test.tsx
index 8715cd5b..c9f2dc9a 100644
--- a/src/components/ChatInput.test.tsx
+++ b/src/components/Chat/Input.test.tsx
@@ -1,24 +1,24 @@
 import { render } from 'ink-testing-library';
 
-import { KEY } from '../constants';
-import { tick } from '../utils/test';
-import { ChatInput } from './ChatInput';
+import { KEY } from '../../constants';
+import { tick } from '../../utils/test';
+import { Input } from './Input';
 
-describe('ChatInput', () => {
+describe('Input', () => {
   it('renders input prompt', () => {
-    const { lastFrame } = render(<ChatInput onSubmit={vi.fn()} />);
+    const { lastFrame } = render(<Input onSubmit={vi.fn()} />);
     expect(lastFrame()).toContain('>');
   });
 
   it('does not show command suggestion on non-slash input', async () => {
-    const { lastFrame, stdin } = render(<ChatInput onSubmit={vi.fn()} />);
+    const { lastFrame, stdin } = render(<Input onSubmit={vi.fn()} />);
     stdin.write('h');
     await tick();
     expect(lastFrame()).not.toContain('/model');
   });
 
   it('shows inline command suggestion when typing /', async () => {
-    const { lastFrame, stdin } = render(<ChatInput onSubmit={vi.fn()} />);
+    const { lastFrame, stdin } = render(<Input onSubmit={vi.fn()} />);
     stdin.write('/');
     await tick();
     expect(lastFrame()).toContain('/model');
@@ -26,7 +26,7 @@ describe('ChatInput', () => {
 
   it('submits typed text on Enter', async () => {
     const onSubmit = vi.fn();
-    const { stdin } = render(<ChatInput onSubmit={onSubmit} />);
+    const { stdin } = render(<Input onSubmit={onSubmit} />);
     stdin.write('h');
     await tick();
     stdin.write('i');
@@ -38,7 +38,7 @@ describe('ChatInput', () => {
 
   it('submits completed slash command on Enter when suggestion is visible', async () => {
     const onSubmit = vi.fn();
-    const { stdin } = render(<ChatInput onSubmit={onSubmit} />);
+    const { stdin } = render(<Input onSubmit={onSubmit} />);
     stdin.write('/');
     await tick();
     stdin.write(KEY.ENTER);
@@ -48,14 +48,14 @@ describe('ChatInput', () => {
 
   it('does not submit blank input', async () => {
     const onSubmit = vi.fn();
-    const { stdin } = render(<ChatInput onSubmit={onSubmit} />);
+    const { stdin } = render(<Input onSubmit={onSubmit} />);
     stdin.write(KEY.ENTER);
     await tick();
     expect(onSubmit).not.toHaveBeenCalled();
   });
 
   it('clears input after submit', async () => {
-    const { lastFrame, stdin } = render(<ChatInput onSubmit={vi.fn()} />);
+    const { lastFrame, stdin } = render(<Input onSubmit={vi.fn()} />);
     stdin.write('h');
     await tick();
     stdin.write('i');
@@ -66,7 +66,7 @@ describe('ChatInput', () => {
   });
 
   it('deletes last character on backspace', async () => {
-    const { lastFrame, stdin } = render(<ChatInput onSubmit={vi.fn()} />);
+    const { lastFrame, stdin } = render(<Input onSubmit={vi.fn()} />);
     stdin.write('/');
     await tick();
     stdin.write('m');
@@ -82,7 +82,7 @@ describe('ChatInput', () => {
   it('does not accept input when disabled', async () => {
     const onSubmit = vi.fn();
     const { lastFrame, stdin } = render(
-      <ChatInput isDisabled onSubmit={onSubmit} />,
+      <Input isDisabled onSubmit={onSubmit} />,
     );
     stdin.write('h');
     await tick();
diff --git a/src/components/ChatInput.tsx b/src/components/Chat/Input.tsx
similarity index 86%
rename from src/components/ChatInput.tsx
rename to src/components/Chat/Input.tsx
index 3e893883..fae6b009 100644
--- a/src/components/ChatInput.tsx
+++ b/src/components/Chat/Input.tsx
@@ -2,14 +2,14 @@ import { TextInput } from '@inkjs/ui';
 import { Box, Text } from 'ink';
 import { useCallback, useState } from 'react';
 
-import { COMMAND, UI } from '../constants';
+import { COMMAND, UI } from '../../constants';
 
 interface Props {
   isDisabled?: boolean;
   onSubmit: (value: string) => void;
 }
 
-export function ChatInput({ isDisabled = false, onSubmit }: Props) {
+export function Input({ isDisabled = false, onSubmit }: Props) {
   const [resetKey, setResetKey] = useState(0);
 
   const handleSubmit = useCallback(
diff --git a/src/components/Chat/constants.ts b/src/components/Chat/constants.ts
new file mode 100644
index 00000000..b0acc115
--- /dev/null
+++ b/src/components/Chat/constants.ts
@@ -0,0 +1,7 @@
+export const ACTION_NOT_PERFORMED = 'The requested action was NOT performed';
+
+export const PLAN_CHECKLIST_REMINDER =
+  'Then display the execution plan as an unchecked Markdown checklist only';
+
+export const PLAN_EXECUTION_REMINDER =
+  'Do not claim success and do not call write_file or run_shell until the user approves execution';
diff --git a/src/components/Chat/index.ts b/src/components/Chat/index.ts
new file mode 100644
index 00000000..eeadfe5a
--- /dev/null
+++ b/src/components/Chat/index.ts
@@ -0,0 +1 @@
+export { Chat } from './Chat';
diff --git a/src/components/Chat/plan.test.ts b/src/components/Chat/plan.test.ts
new file mode 100644
index 00000000..d76def56
--- /dev/null
+++ b/src/components/Chat/plan.test.ts
@@ -0,0 +1,45 @@
+import { hasExecutablePlan } from './plan';
+
+describe('hasExecutablePlan', () => {
+  it('returns true for a write_file plan step', () => {
+    expect(
+      hasExecutablePlan('- [ ] write_file("src/app.ts", "content") - Update'),
+    ).toBe(true);
+  });
+
+  it('returns true for a run_shell plan step', () => {
+    expect(
+      hasExecutablePlan('- [ ] run_shell("npm test") - Run the test suite'),
+    ).toBe(true);
+  });
+
+  it('returns true for an edit_file plan step', () => {
+    expect(
+      hasExecutablePlan(
+        '- [ ] edit_file("src/app.ts", "oldText", "newText") - Refine logic',
+      ),
+    ).toBe(true);
+  });
+
+  it('returns true when an executable step appears later in the content', () => {
+    expect(
+      hasExecutablePlan(
+        'Here is the plan:\n\n- [ ] run_shell("npm run build") - Verify build',
+      ),
+    ).toBe(true);
+  });
+
+  it('returns false for conversational text', () => {
+    expect(hasExecutablePlan('This can be answered directly.')).toBe(false);
+  });
+
+  it('returns false for checklist items without executable tools', () => {
+    expect(hasExecutablePlan('- [ ] explain the bug')).toBe(false);
+  });
+
+  it('returns false for unsupported tool names', () => {
+    expect(
+      hasExecutablePlan('- [ ] deploy("production") - Release the build'),
+    ).toBe(false);
+  });
+});
diff --git a/src/components/Chat/plan.ts b/src/components/Chat/plan.ts
new file mode 100644
index 00000000..396491b9
--- /dev/null
+++ b/src/components/Chat/plan.ts
@@ -0,0 +1,6 @@
+export function hasExecutablePlan(content: string): boolean {
+  return content.split('\n').some((line) => {
+    const trimmedLine = line.trim();
+    return /^- \[ \] (write_file|edit_file|run_shell)\(/.test(trimmedLine);
+  });
+}
diff --git a/src/components/Footer.test.tsx b/src/components/Footer.test.tsx
index b5fddfed..8b34828d 100644
--- a/src/components/Footer.test.tsx
+++ b/src/components/Footer.test.tsx
@@ -1,29 +1,41 @@
 import { render } from 'ink-testing-library';
 
+import { MODE } from '../constants';
 import { tick } from '../utils/test';
 import { Footer } from './Footer';
 
 describe('Footer', () => {
-  it('renders Safe mode when autoExecute is false', () => {
+  it('renders Safe mode', () => {
     const { lastFrame } = render(
-      <Footer autoExecute={false} onToggleMode={vi.fn()} />,
+      <Footer mode={MODE.NAME.SAFE} onToggleMode={vi.fn()} />,
     );
-    expect(lastFrame()).toContain('Mode: Safe');
+    expect(lastFrame()).toContain('Mode:');
+    expect(lastFrame()).toContain('Safe');
     expect(lastFrame()).toContain('Shift+Tab to toggle');
   });
 
-  it('renders Auto mode when autoExecute is true', () => {
+  it('renders Auto mode', () => {
     const { lastFrame } = render(
-      <Footer autoExecute={true} onToggleMode={vi.fn()} />,
+      <Footer mode={MODE.NAME.AUTO} onToggleMode={vi.fn()} />,
     );
-    expect(lastFrame()).toContain('Mode: Auto');
+    expect(lastFrame()).toContain('Mode:');
+    expect(lastFrame()).toContain('Auto');
+    expect(lastFrame()).toContain('Shift+Tab to toggle');
+  });
+
+  it('renders Plan mode', () => {
+    const { lastFrame } = render(
+      <Footer mode={MODE.NAME.PLAN} onToggleMode={vi.fn()} />,
+    );
+    expect(lastFrame()).toContain('Mode:');
+    expect(lastFrame()).toContain('Plan');
     expect(lastFrame()).toContain('Shift+Tab to toggle');
   });
 
   it('calls onToggleMode when Shift+Tab is pressed', async () => {
     const mockToggle = vi.fn();
     const { stdin } = render(
-      <Footer autoExecute={false} onToggleMode={mockToggle} />,
+      <Footer mode={MODE.NAME.SAFE} onToggleMode={mockToggle} />,
     );
 
     // Send Shift+Tab escape sequence
@@ -36,7 +48,7 @@ describe('Footer', () => {
   it('does not call onToggleMode for regular key presses', async () => {
     const mockToggle = vi.fn();
     const { stdin } = render(
-      <Footer autoExecute={false} onToggleMode={mockToggle} />,
+      <Footer mode={MODE.NAME.SAFE} onToggleMode={mockToggle} />,
     );
 
     // Send a regular Tab (without shift)
diff --git a/src/components/Footer.tsx b/src/components/Footer.tsx
index c9c30587..12b3f6d7 100644
--- a/src/components/Footer.tsx
+++ b/src/components/Footer.tsx
@@ -1,22 +1,40 @@
 import { Box, Text, useInput } from 'ink';
 
+import { MODE } from '../constants';
+
 interface Props {
-  autoExecute: boolean;
+  mode: MODE.Name;
   onToggleMode: () => void;
 }
 
-export function Footer({ autoExecute, onToggleMode }: Props) {
-  // Keyboard shortcut to toggle auto-execute mode
+function getModeColor(mode: MODE.Name): string | undefined {
+  switch (mode) {
+    case MODE.NAME.PLAN:
+      return 'blue';
+    case MODE.NAME.AUTO:
+      return 'red';
+    case MODE.NAME.SAFE:
+    default:
+      return 'green';
+  }
+}
+
+export function Footer({ mode, onToggleMode }: Props) {
+  // Keyboard shortcut to toggle mode (3-state cycle)
   useInput((_, key) => {
     if (key.tab && key.shift) {
       onToggleMode();
     }
   });
 
+  const modeLabel = MODE.LABEL[mode];
+  const modeColor = getModeColor(mode);
+
   return (
     <Box justifyContent="space-between" marginTop={1}>
       <Text dimColor>
-        Mode: {autoExecute ? 'Auto' : 'Safe'} (Shift+Tab to toggle)
+        Mode: <Text color={modeColor}>{modeLabel}</Text>
+        <Text dimColor> (Shift+Tab to toggle)</Text>
       </Text>
     </Box>
   );
diff --git a/src/components/PlanApproval.test.tsx b/src/components/PlanApproval.test.tsx
new file mode 100644
index 00000000..10a1fbdc
--- /dev/null
+++ b/src/components/PlanApproval.test.tsx
@@ -0,0 +1,113 @@
+import { render } from 'ink-testing-library';
+
+import { KEY, MODE } from '../constants';
+import { tick } from '../utils/test';
+
+const { mockOnChange } = vi.hoisted(() => ({
+  mockOnChange: vi.fn<(value: MODE.Name) => void>(),
+}));
+
+vi.mock('@inkjs/ui', async () => {
+  const { Text } = await import('ink');
+  return {
+    Select: ({
+      options,
+      onChange,
+    }: {
+      options: { label: string; value: MODE.Name }[];
+      defaultValue?: MODE.Name;
+      onChange?: (value: MODE.Name) => void;
+    }) => {
+      mockOnChange.mockImplementation((value) => onChange?.(value));
+      return (
+        <>
+          {options.map(({ value, label }) => (
+            <Text key={value}>{label}</Text>
+          ))}
+        </>
+      );
+    },
+  };
+});
+
+import { PlanApproval } from './PlanApproval';
+
+describe('PlanApproval', () => {
+  it('renders plan content', () => {
+    const { lastFrame } = render(
+      <PlanApproval
+        planContent="- [ ] write_file('test.txt') - Create test file"
+        onModeChange={vi.fn()}
+      />,
+    );
+    expect(lastFrame()).toContain('Plan Generated');
+    expect(lastFrame()).toContain('write_file');
+  });
+
+  it('calls onModeChange with auto when auto is chosen', () => {
+    const onModeChange = vi.fn();
+    render(
+      <PlanApproval planContent="test plan" onModeChange={onModeChange} />,
+    );
+
+    mockOnChange(MODE.NAME.AUTO);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.AUTO);
+  });
+
+  it('calls onModeChange with safe when safe is chosen', () => {
+    const onModeChange = vi.fn();
+    render(
+      <PlanApproval planContent="test plan" onModeChange={onModeChange} />,
+    );
+
+    mockOnChange(MODE.NAME.SAFE);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.SAFE);
+  });
+
+  it('calls onModeChange with plan when plan is chosen', () => {
+    const onModeChange = vi.fn();
+    render(
+      <PlanApproval planContent="test plan" onModeChange={onModeChange} />,
+    );
+
+    mockOnChange(MODE.NAME.PLAN);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.PLAN);
+  });
+
+  it('calls onModeChange with plan when Escape is pressed', async () => {
+    const onModeChange = vi.fn();
+    const { stdin } = render(
+      <PlanApproval planContent="test plan" onModeChange={onModeChange} />,
+    );
+
+    stdin.write(KEY.ESCAPE);
+    await tick(50);
+
+    expect(onModeChange).toHaveBeenCalledWith(MODE.NAME.PLAN);
+  });
+
+  it('ignores non-escape keys', async () => {
+    const onModeChange = vi.fn();
+    const { stdin } = render(
+      <PlanApproval planContent="test plan" onModeChange={onModeChange} />,
+    );
+
+    stdin.write(KEY.ENTER);
+    await tick(50);
+
+    expect(onModeChange).not.toHaveBeenCalled();
+  });
+
+  it('shows all three options', () => {
+    const { lastFrame } = render(
+      <PlanApproval planContent="test plan" onModeChange={vi.fn()} />,
+    );
+
+    expect(lastFrame()).toContain('Auto');
+    expect(lastFrame()).toContain('Safe');
+    expect(lastFrame()).toContain('Cancel');
+  });
+});
diff --git a/src/components/PlanApproval.tsx b/src/components/PlanApproval.tsx
new file mode 100644
index 00000000..de823f70
--- /dev/null
+++ b/src/components/PlanApproval.tsx
@@ -0,0 +1,49 @@
+import { Select } from '@inkjs/ui';
+import { Box, Text, useInput } from 'ink';
+import { useCallback } from 'react';
+
+import { MODE } from '../constants';
+
+interface Props {
+  planContent: string;
+  onModeChange: (mode: MODE.Name) => void;
+}
+
+const options = [
+  { label: 'Auto - Execute tools automatically', value: MODE.NAME.AUTO },
+  { label: 'Safe - Approve each tool', value: MODE.NAME.SAFE },
+  { label: 'Cancel - Continue planning', value: MODE.NAME.PLAN },
+];
+
+export function PlanApproval({ planContent, onModeChange }: Props) {
+  useInput((_, key) => {
+    if (key.escape) {
+      onModeChange(MODE.NAME.PLAN);
+    }
+  });
+
+  const handleChange = useCallback(
+    (value: string) => {
+      onModeChange(value as MODE.Name);
+    },
+    [onModeChange],
+  );
+
+  return (
+    <Box flexDirection="column" marginTop={1}>
+      <Text bold color="magenta">
+        Plan Generated - Choose execution mode:
+      </Text>
+
+      <Box marginY={1}>
+        <Text>{planContent}</Text>
+      </Box>
+
+      <Text dimColor>
+        Select execution mode (↑↓ + Enter to confirm, Esc to cancel)
+      </Text>
+
+      <Select options={options} onChange={handleChange} />
+    </Box>
+  );
+}
diff --git a/src/components/index.ts b/src/components/index.ts
index 4e671c98..eb4286e9 100644
--- a/src/components/index.ts
+++ b/src/components/index.ts
@@ -1,8 +1,9 @@
 export { App } from './App';
 export { Chat } from './Chat';
-export { ChatInput } from './ChatInput';
+export { Input } from './Chat/Input';
 export { Footer } from './Footer';
 export { Header } from './Header';
 export { Messages } from './Messages';
 export { ModelPicker } from './ModelPicker';
+export { PlanApproval } from './PlanApproval';
 export { ToolApproval } from './ToolApproval';
diff --git a/src/constants/index.ts b/src/constants/index.ts
index 7c2f6fc0..aa1e736e 100644
--- a/src/constants/index.ts
+++ b/src/constants/index.ts
@@ -1,5 +1,6 @@
 export * as COMMAND from './command';
 export * as KEY from './key';
+export * as MODE from './mode';
 export * as PACKAGE from './package';
 export * as PROMPT from './prompt';
 export * from './role';
diff --git a/src/constants/mode.ts b/src/constants/mode.ts
new file mode 100644
index 00000000..b2f023e8
--- /dev/null
+++ b/src/constants/mode.ts
@@ -0,0 +1,13 @@
+export const NAME = {
+  SAFE: 'safe',
+  AUTO: 'auto',
+  PLAN: 'plan',
+} as const;
+
+export type Name = (typeof NAME)[keyof typeof NAME];
+
+export const LABEL: Record<Name, string> = {
+  safe: 'Safe',
+  auto: 'Auto',
+  plan: 'Plan',
+};
diff --git a/src/constants/prompt.ts b/src/constants/prompt.ts
index 28527d6d..6c17b900 100644
--- a/src/constants/prompt.ts
+++ b/src/constants/prompt.ts
@@ -23,3 +23,17 @@ Always use tools when you need to:
 - Make file changes
 - Explore project structure
 - Search the codebase`;
+
+export const PLAN_GENERATION_INSTRUCTION = `Based on the research above, decide whether the user request needs code or shell execution
+
+If the request needs changes or commands, respond with a plan checklist only
+Do not execute any tools
+Do not claim any action was performed
+Display the plan as an unchecked Markdown checklist using only these forms:
+
+- [ ] write_file("path/to/file", "content") - Brief description
+- [ ] edit_file("path/to/file", "oldText", "newText") - Brief description
+- [ ] run_shell("command") - Brief description
+
+Only include write_file, edit_file, and run_shell tools in the checklist
+If no execution is needed, answer normally`;
diff --git a/src/utils/agents.ts b/src/utils/agents.ts
index 64ca541f..1df87a79 100644
--- a/src/utils/agents.ts
+++ b/src/utils/agents.ts
@@ -1,8 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { ROLE } from '../constants';
-import { BASE_SYSTEM_PROMPT, TOOL_INSTRUCTIONS } from '../constants/prompt';
+import { PROMPT, ROLE } from '../constants';
 import type * as ollama from './ollama';
 
 const AGENTS_FILE = 'AGENTS.md';
@@ -23,14 +22,14 @@ function loadAgentsContent(): string | null {
 }
 
 export function buildSystemPrompt(): string {
-  const parts: string[] = [BASE_SYSTEM_PROMPT];
+  const parts: string[] = [PROMPT.BASE_SYSTEM_PROMPT];
 
   const agentsContent = loadAgentsContent();
   if (agentsContent) {
     parts.push('\n\nProject context from AGENTS.md:\n', agentsContent);
   }
 
-  parts.push('\n\n', TOOL_INSTRUCTIONS);
+  parts.push('\n\n', PROMPT.TOOL_INSTRUCTIONS);
 
   return parts.join('');
 }
diff --git a/src/utils/tools.test.ts b/src/utils/tools.test.ts
index d5719865..4d42a819 100644
--- a/src/utils/tools.test.ts
+++ b/src/utils/tools.test.ts
@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { executeTool, TOOLS, TOOLS_REQUIRING_APPROVAL } from './tools';
+import { DANGEROUS_TOOLS, executeTool, READ_ONLY_TOOLS, TOOLS } from './tools';
 
 vi.mock('node:fs');
 vi.mock('node:child_process', () => ({
@@ -29,14 +29,12 @@ describe('tools', () => {
     });
   });
 
-  describe('TOOLS_REQUIRING_APPROVAL', () => {
+  describe('DANGEROUS_TOOLS', () => {
     it('contains write_file, edit_file, and run_shell', () => {
-      expect(TOOLS_REQUIRING_APPROVAL.has('write_file')).toBe(true);
-      expect(TOOLS_REQUIRING_APPROVAL.has('edit_file')).toBe(true);
-      expect(TOOLS_REQUIRING_APPROVAL.has('run_shell')).toBe(true);
-      expect(TOOLS_REQUIRING_APPROVAL.has('read_file' as 'write_file')).toBe(
-        false,
-      );
+      expect(DANGEROUS_TOOLS.has('write_file')).toBe(true);
+      expect(DANGEROUS_TOOLS.has('edit_file')).toBe(true);
+      expect(DANGEROUS_TOOLS.has('run_shell')).toBe(true);
+      expect(DANGEROUS_TOOLS.has('read_file')).toBe(false);
     });
   });
 
@@ -86,6 +84,20 @@ describe('tools', () => {
       );
     });
 
+    it('blocks disallowed tools when allowedTools is provided', async () => {
+      const result = await executeTool(
+        'write_file',
+        {
+          path: '/test.txt',
+          content: 'new content',
+        },
+        { allowedTools: READ_ONLY_TOOLS },
+      );
+
+      expect(result.error).toBe('Tool not allowed: write_file');
+      expect(vi.mocked(writeFileSync)).not.toHaveBeenCalled();
+    });
+
     it('executes list_dir tool', async () => {
       vi.mocked(existsSync).mockReturnValue(true);
       vi.mocked(readdirSync).mockReturnValue([
diff --git a/src/utils/tools.ts b/src/utils/tools.ts
index 036aeefb..8635f26b 100644
--- a/src/utils/tools.ts
+++ b/src/utils/tools.ts
@@ -125,25 +125,45 @@ export const TOOLS = [
   ),
 ];
 
-// for safe mode
-export const TOOLS_REQUIRING_APPROVAL = new Set([
+// tools that can be used during plan mode
+export const READ_ONLY_TOOLS = new Set<string>([
+  TOOL.NAME.READ_FILE,
+  TOOL.NAME.LIST_DIR,
+  TOOL.NAME.GREP_SEARCH,
+  TOOL.NAME.VIEW_RANGE,
+]);
+
+// tools that require approval before execution (safe mode or plan approval)
+export const DANGEROUS_TOOLS = new Set<string>([
   TOOL.NAME.WRITE_FILE,
   TOOL.NAME.EDIT_FILE,
   TOOL.NAME.RUN_SHELL,
 ]);
 
-interface ToolExecutionResult {
+export interface ToolExecutionResult {
   content: string;
   error?: string;
 }
 
+interface ToolExecutionOptions {
+  allowedTools?: ReadonlySet<string>;
+}
+
 /**
  * Execute a tool by name with arguments
  */
 export async function executeTool(
   name: string,
   args: Record<string, unknown>,
+  options?: ToolExecutionOptions,
 ): Promise<ToolExecutionResult> {
+  if (options?.allowedTools && !options.allowedTools.has(name)) {
+    return {
+      content: '',
+      error: `Tool not allowed: ${name}`,
+    };
+  }
+
   switch (name) {
     case TOOL.NAME.READ_FILE:
       return readFile(args.path as string);